rapier-markdown-kit 1.1.104 → 1.2.5

package/dist/kit/ledger/authored-origin.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// Immutable authored origins shared by causal transport and inverse projection.
+import {_rapierTransformSplices, _rapierValidAuthored} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+
+// The frontier names only causal maxima. Linear history needs one predecessor,
+// and concurrent predecessors remain separate until an act observes both.
+function authoredFrontier(records, visit = null) {
+  const dependencies = new Map(), frontier = new Set();
+  for (const record of records) {
+    const id = record.transaction.id, basis = record.authored?.basis;
+    if (visit) visit(record, basis ?? [...frontier].sort());
+    if (!basis) { dependencies.set(id, [...frontier]); frontier.clear(); }
+    else {
+      const pending = [...basis], seen = new Set();
+      while (pending.length) {
+        const prior = pending.pop();
+        if (seen.has(prior)) continue;
+        if (!dependencies.has(prior)) throw new RangeError('canonical_origin_invalid');
+        seen.add(prior); frontier.delete(prior); pending.push(...dependencies.get(prior));
+      }
+      dependencies.set(id, basis);
+    }
+    frontier.add(id);
+  }
+  return [...frontier].sort();
+}
+
+export function authoredBasis(records) { return authoredFrontier(records); }
+
+export function authoredPlacements(base, records) {
+  const origins = new Map(); let source = base;
+  authoredFrontier(records, (record, basis) => {
+    origins.set(record.transaction.id, record.authored ?? authoredPlacement(source, record.splices, basis));
+    source = _rapierTransformSplices(source, record.splices);
+    if (source === null) throw new RangeError('canonical_origin_invalid');
+  });
+  return origins;
+}
+
+// Immutable authored placement stays on its own act. Basis IDs refer only to this
+// canonical history; no source snapshot or duplicate history is stored.
+export function authoredPlacement(source, splices, basis) {
+  const origin = {basis: basis.slice().sort(), source: sha256(source), splices: splices.map(row => ({...row}))};
+  if (!_rapierValidAuthored(origin) || _rapierTransformSplices(source, splices) === null)
+    throw new RangeError('canonical_origin_invalid');
+  return origin;
+}
+

package/dist/kit/ledger/authorship.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import {readLedger, exportLedger, textRoot, rootAfter} from './format.mjs';
-import {_rapierTransformSplices} from './journal-records.mjs';
+import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
 import {sha256} from './hash.mjs';
 import {plainData, documentText, nonnegative, exactKeys, fault} from './data.mjs';
 function coalesce(runs) {
@@ -14,16 +14,25 @@ function coalesce(runs) {
   return out;
 }
 export function authorship(input) {
-  const {ledger, text} = readLedger(input);
+  const {ledger, text} = readLedger(input), references = _rapierHistoryEffects(ledger.records).references, removed = new Map();
   let runs = ledger.start.text ? [[0, ledger.start.text.length, 'system', 'unattributed', 0]] : [];
-  for (const record of ledger.records) for (const row of record.splices) {
-    const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [];
-    for (const run of runs) {
-      if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
-      if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+  for (const record of ledger.records) {
+    // An Undo or Redo puts back text the act it references removed: that text keeps the runs it had.
+    const tx = record.transaction, gone = [], kept = (references?.get(tx.id) || []).flatMap(id => removed.get(id) || []);
+    for (const row of record.splices) {
+      const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [], inside = [];
+      for (const run of runs) {
+        if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
+        if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+        if (run[0] < cut && run[1] > row.pos) inside.push([Math.max(run[0], row.pos) - row.pos, Math.min(run[1], cut) - row.pos, ...run.slice(2)]);
+      }
+      if (row.removed) gone.push({text: row.removed, runs: inside});
+      const at = row.inserted ? kept.findIndex(entry => entry.text === row.inserted) : -1;
+      const put = at < 0 ? [[row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt]]
+        : kept.splice(at, 1)[0].runs.map(run => [run[0] + row.pos, run[1] + row.pos, ...run.slice(2)]);
+      runs = coalesce([...before, ...put, ...after]);
     }
-    const tx = record.transaction;
-    runs = coalesce([...before, [row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt], ...after]);
+    removed.set(tx.id, gone);
   }
   return {format: 'rapier-authorship/1', sha256: sha256(text), runs};
 }

package/dist/kit/ledger/carried.mjs

@@ -73,7 +73,7 @@ export function readDocument(source) {
 export function readBase(value) {
   if (!value || typeof value !== 'object') throw fault('comparison base SHA-256 differs from its text');
   // Capture each caller-owned field once; admission and serialization use these same scalars.
-  const {text, sha256: digest, revision, name, by, at} = value;
+  const {text, sha256: digest, revision, name, by, at, fonts} = value;
   if (typeof text !== 'string' || typeof digest !== 'string' || !/^[a-f0-9]{64}$/.test(digest) || sha256(text) !== digest)
     throw fault('comparison base SHA-256 differs from its text');
   if (typeof revision !== 'string' || !revision || revision.length > 256 || /[\u0000-\u001f\u007f]/.test(revision))
@@ -84,7 +84,8 @@ export function readBase(value) {
     throw fault('a comparison needs its author name');
   if (typeof at !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(at) || !Number.isFinite(Date.parse(at)))
     throw fault('the time of a comparison is an ISO 8601 UTC timestamp');
-  return {text, sha256: digest, revision, name, by, at};
+  if (fonts != null && typeof fonts !== 'string') throw fault('invalid comparison font resources');
+  return {text, sha256: digest, revision, name, by, at, ...(fonts ? {fonts} : {})};
 }
 const escapeAttribute = value => value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 const readAttribute = value => value.replace(/&(quot|lt|gt|amp);/g, (_, name) => ({quot: '"', lt: '<', gt: '>', amp: '&'})[name]);
@@ -93,7 +94,8 @@ export function writeBase(text, value) {
   const base = readBase(value);
   if (base.text === text) return '';
   return '<script type="text/markdown" id="rapier-base"' + ['name', 'sha256', 'revision', 'by', 'at']
-    .map(key => ' data-' + key + '="' + escapeAttribute(base[key]) + '"').join('') + '>' + encodeCarried(base.text) + '</script>';
+    .map(key => ' data-' + key + '="' + escapeAttribute(base[key]) + '"').join('') +
+    (base.fonts ? ' data-fonts="' + escapeAttribute(JSON.stringify(base.fonts)) + '"' : '') + '>' + encodeCarried(base.text) + '</script>';
 }
 export function readBaseElements(elements) {
   const rows = [...elements].filter(element => element.id === 'rapier-base');
@@ -102,7 +104,10 @@ export function readBaseElements(elements) {
   if (rows.length !== 1 || row.type !== 'text/markdown' || (row.tagName && row.tagName.toLowerCase() !== 'script'))
     throw fault('duplicate or executable comparison base');
   const get = name => row.getAttribute ? row.getAttribute('data-' + name) : row[name];
-  return readBase({text: decodeCarried(row.textContent), ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at'].map(key => [key, get(key)]))});
+  let fonts;
+  try { const value = get('fonts'); if (value != null) fonts = JSON.parse(value); }
+  catch (_) { throw fault('invalid comparison font resources'); }
+  return readBase({text: decodeCarried(row.textContent), fonts, ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at'].map(key => [key, get(key)]))});
 }
 export function takeBase(html) {
   const elements = [];
@@ -115,7 +120,7 @@ export function takeBase(html) {
       seen.add(key); values[key] = value;
     }
     elements.push({id: values.id, type: values.type, textContent: content,
-      ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at'].map(key => [key, values['data-' + key]]))});
+      ...Object.fromEntries(['name', 'sha256', 'revision', 'by', 'at', 'fonts'].map(key => [key, values['data-' + key]]))});
     return '';
   });
   return {html: stripped, base: readBaseElements(elements)};

package/dist/kit/ledger/data.mjs

@@ -1,10 +1,13 @@
 // SPDX-License-Identifier: MIT
 // Only plain JSON data enters the public format. Accessors and toJSON are never executed.
 export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
-function fields(value, depth, active, sorted = true) {
+// A plain object's prototype is null or Object's own. Both lookups read descriptors, so no getter runs.
+export const plainPrototype = proto => proto === null || Object.getPrototypeOf(proto) === null &&
+  Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(proto, 'constructor')?.value || {}, 'name')?.value === 'Object';
+export function fields(value, depth, active, sorted = true) {
   if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
-  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-  if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
+  const array = Array.isArray(value);
+  if (!array && !plainPrototype(Object.getPrototypeOf(value))) throw fault('not a plain object');
   const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
   for (const key of keys) {
     if (array && key === 'length') continue;
@@ -14,7 +17,7 @@ function fields(value, depth, active, sorted = true) {
   if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
   return {array, descriptors, keys: array ? keys.filter(key => key !== 'length') : sorted ? keys.sort() : keys};
 }
-function scalar(value) {
+export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
   if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);

package/dist/kit/ledger/format.mjs

@@ -27,12 +27,34 @@ function* checkedRecords(ledger, prepared) {
   }
   if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
 }
+// A ledger object read again is proved once: a boot reads one stored history through several records. The proof holds only
+// while that object still carries the exact proved data (its start text compared whole, the rest as canonical JSON), so a
+// changed byte is proved again, and refused. The proof lives as long as the object does.
+const proofs = new WeakMap();
 function readLedgerState(input, expectedText, expectedMetadata) {
   const ledger = plainData(input);
+  // The identifier rapier-ledger/2 is unchanged and is not backward compatible. This reader
+  // admits an empty physical splice whose authored rows name the same replacement. A reader
+  // from before that rule rejects the chain. Mixed-version sync throws notes_history_unavailable
+  // and leaves the older store unchanged; that refusal is not a held or caughtUp result.
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
       typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
       !exactKeys(ledger.start, ['text','revision','root','sha256','metadata']) || !exactKeys(ledger.head, ['revision','root','sha256','metadata'])) throw fault('unsupported or invalid envelope');
+  const shell = canonicalJSON({...ledger, start: {...ledger.start, text: ''}});
+  let proof = typeof input === 'object' ? proofs.get(input) : undefined;
+  if (!proof || proof.shell !== shell || proof.startText !== ledger.start.text) {
+    proof = {shell, startText: ledger.start.text, ...proveLedger(ledger)};
+    if (typeof input === 'object') proofs.set(input, proof);
+  }
+  proofs.set(ledger, proof);
+  const {text, metadata, root, revision, prepared, source} = proof;
+  if (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata)))
+    throw fault('metadata does not describe this document');
+  if (expectedText !== undefined && text !== expectedText) throw fault('history does not describe this document');
+  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source};
+}
+function proveLedger(ledger) {
   const {sha256: claimed, ...payload} = ledger;
   if (claimed !== digest(payload)) throw fault('envelope checksum differs');
   let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
@@ -55,12 +77,18 @@ function readLedgerState(input, expectedText, expectedMetadata) {
     try { authoredHistory(ledger.start.text, ledger.records); } catch (_) { throw fault('authored origin differs'); }
   }
   const metadata = prepared.replayMetadata(ledger.start.metadata);
-  if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata) ||
-      (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata))))
-    throw fault('metadata does not describe this document');
-  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text) ||
-      (expectedText !== undefined && text !== expectedText)) throw fault('history does not describe this document');
-  return {value: {ledger, text, metadata, root, revision, complete: ledger.complete}, prepared, source};
+  if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata)) throw fault('metadata does not describe this document');
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text)) throw fault('history does not describe this document');
+  return {text, metadata, root, revision, prepared, source};
+}
+// A stored copy may hold the head text alone. Its start is that text with every record reversed; readLedger proves it.
+export function ledgerWithStart(input, text) {
+  let source = new HistorySource(documentText(text));
+  for (let i = input.records.length - 1; i >= 0; i--) {
+    source = source.apply(input.records[i].splices, true);
+    if (source === null) throw fault('history does not reverse from this document');
+  }
+  return {...input, start: {...input.start, text: source.slice()}};
 }
 export function readLedger(input, expectedText, expectedMetadata) {
   return readLedgerState(input, expectedText, expectedMetadata).value;
@@ -163,9 +191,7 @@ function finish(producer) {
   return step.value;
 }
 export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
-// Both synchronous public export and cooperative recovery use the same producer.
 // Its returned facts were computed while admitting/hashing the exact head, never supplied.
-export function prepareLedger(input) { return finish(produceLedger(input)); }
 export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
   const producer = produceLedger(input);
   let step;
@@ -182,8 +208,8 @@ export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {})
   return step.value;
 }
 // Derived navigation, never a second history. A target older than start is intentionally unavailable.
-export function historyEnvelope(input, segmentIdentity = []) {
-  const {value: {ledger, text, metadata}, prepared, source} = readLedgerState(input);
+export function historyEnvelope(input, segmentIdentity = [], expectedText, expectedMetadata) {
+  const {value: {ledger, text, metadata}, prepared, source} = readLedgerState(input, expectedText, expectedMetadata);
   const {byId, effects: {pictures}} = prepared;
   let branch = [], cursor = 0;
   for (const {transaction: tx} of ledger.records) {
@@ -198,7 +224,7 @@ export function historyEnvelope(input, segmentIdentity = []) {
   }
   const step = (source, id, redo) => {
     const target = byId.get(id), folded = pictures.size
-      ? pictureHistorySplices({source: source.slice(), records: prepared.records}, target, redo) : null;
+      ? pictureHistorySplices({get source() { return source.slice(); }, records: prepared.records}, target, redo) : null;
     return source.apply(folded || target.splices, !folded && !redo);
   };
   let traversed = source, traversedMetadata = {...metadata};

package/dist/kit/ledger/hash.mjs

@@ -30,13 +30,11 @@ const K = new Uint32Array([
   0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
 ]);
 const rotate = (x, n) => (x >>> n) | (x << (32 - n));
-// A bounded encoder and one compression block. No full UTF-8 or padded-input copy.
-// Updates retain a trailing high surrogate so an arbitrary string boundary stays exact.
-export function createSHA256() {
+// One bounded SHA-256 compression state for file bytes and encoded source text.
+export function sha256State() {
   const h = new Uint32Array([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]);
-  const w = new Uint32Array(64), block = new Uint8Array(64), encoded = new Uint8Array(65536);
-  const encoder = new TextEncoder();
-  let used = 0, bytes = 0, high = '', finished = false;
+  const w = new Uint32Array(64), block = new Uint8Array(64);
+  let used = 0, bytes = 0, finished = false;
   const compress = (input, offset) => {
     for (let i = 0; i < 16; i++) {
       const at = offset + i * 4;
@@ -65,13 +63,37 @@ export function createSHA256() {
     for (; at + 64 <= size; at += 64) compress(input, at);
     if (at < size) { block.set(input.subarray(at, size), 0); used = size - at; }
   };
+  return {
+    update(input) {
+      if (finished || !(input instanceof Uint8Array)) throw new TypeError('SHA-256 needs bytes before finish');
+      if (!Number.isSafeInteger(bytes + input.length)) throw new Error('SHA-256 input length is not exact');
+      feed(input, input.length);
+    },
+    finish() {
+      if (finished) throw new Error('SHA-256 is already finished');
+      finished = true;
+      block[used++] = 0x80; block.fill(0, used);
+      if (used > 56) { compress(block, 0); block.fill(0); }
+      const view = new DataView(block.buffer);
+      view.setUint32(56, Math.floor(bytes / 0x20000000)); view.setUint32(60, (bytes * 8) >>> 0);
+      compress(block, 0);
+      return Array.from(h, x => x.toString(16).padStart(8, '0')).join('');
+    },
+    get bytes() { return bytes; },
+  };
+}
+// UTF-16 chunks share that byte state. Retain a trailing high surrogate so a
+// caller can split a character between updates without changing its UTF-8 digest.
+export function createSHA256() {
+  const hash = sha256State(), encoded = new Uint8Array(65536), encoder = new TextEncoder();
+  let high = '', finished = false;
   const write = text => {
     for (let at = 0; at < text.length;) {
       // Bound both the substring and byte allocation; encodeInto never cuts a scalar.
       let end = Math.min(text.length, at + 32768);
       if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
       const part = encoder.encodeInto(text.slice(at, end), encoded);
-      feed(encoded, part.written); at += part.read;
+      hash.update(encoded.subarray(0, part.written)); at += part.read;
     }
   };
   return {
@@ -85,15 +107,9 @@ export function createSHA256() {
       if (finished) throw new Error('SHA-256 is finished');
       if (high) { write(high); high = ''; }
       finished = true;
-      const bits = bytes * 8;
-      block[used++] = 0x80; block.fill(0, used);
-      if (used > 56) { compress(block, 0); block.fill(0); }
-      const view = new DataView(block.buffer);
-      view.setUint32(56, Math.floor(bits / 0x100000000)); view.setUint32(60, bits >>> 0);
-      compress(block, 0);
-      return Array.from(h, x => x.toString(16).padStart(8, '0')).join('');
+      return hash.finish();
     },
-    get bytes() { return bytes; },
+    get bytes() { return hash.bytes; },
   };
 }
 export function sha256Parts(parts) {

package/dist/kit/ledger/history.mjs

@@ -1,10 +1,10 @@
 // SPDX-License-Identifier: MIT
 // Transient projections and selective inverses of the existing canonical journal.
-import {_rapierTransformSplices, _rapierRecordSplices, _rapierRecordMetadata, _rapierValidMetadata, _rapierTransformMetadata, _rapierMetadataDelta, _rapierHistoryEffects, _rapierMetadataState, _rapierReplayMetadata, _rapierPrepareHistoryRecords} from './journal-records.mjs';
+import {_rapierTransformSplices, _rapierValidMetadata, _rapierTransformMetadata, _rapierMetadataDelta, _rapierHistoryEffects, _rapierMetadataState, _rapierPrepareHistoryRecords} from './journal-records.mjs';
 import {projectInverseSource, HistorySource} from './inverse-source.mjs';
 import {textRootParts, rootAfter} from './hash.mjs';
-import {authoredHistory} from './transport.mjs';
-import {plainData} from './data.mjs';
+import {authoredHistory, authoredPlacements} from './transport.mjs';
+import {plainData, canonicalJSON} from './data.mjs';
 
 const historyFailure = reason => ({ok: false, reason});
 const historyInteger = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
@@ -43,11 +43,15 @@ export function groupHistoryActs(acts) {
 
 // A picture's codec replacement travels with its original navigation step.
 // Match every complete replacement exactly before moving any source bytes.
-export function pictureHistorySplices({source, records}, target, redo) {
+export function pictureHistorySplices(input, target, redo) {
+	const {records} = input;
 	const id = target?.transaction?.id, at = records.indexOf(target);
 	if (!id || at < 0 || target.transaction.operation === 'document.finish-picture' || !Array.isArray(target.splices)) return null;
 	const later = records.slice(at + 1).filter(row => row?.transaction?.operation === 'document.finish-picture' && Array.isArray(row.splices) && row.splices.length);
 	if (!later.length) return null;
+	// A caller may hold a persistent source tree: request its text only when
+	// a later picture replacement can actually affect this navigation step.
+	const source = input.source;
 	const own = new Set(later.filter(row => row.transaction.sourceTransactionId === id));
 	const step = redo ? target.splices : target.splices.slice().reverse().map(row => ({pos: row.pos, removed: row.inserted, inserted: row.removed}));
 	const plan = moveOthers => {
@@ -100,8 +104,11 @@ function prepareHistory(input) {
 				!(tx.createdAt === null || historyInteger(tx.createdAt)) ||
 				(tx.turnId != null && (typeof tx.turnId !== 'string' || !tx.turnId || tx.turnId.length > 160))) return historyFailure('history_invalid');
 			if (tx.baseRevision !== prior) complete = false;
+			const coincidentWitness = !splices.length && record.authored && Array.isArray(record.authored.splices) &&
+				record.authored.splices.some(row => row.removed.length);
 			if (!splices || effect === undefined || (!splices.length &&
-				!Object.values(effect || {}).some(pair => pair.before !== pair.after) && !effects.references.get(tx.id)?.length)) return historyFailure('history_unavailable');
+				!Object.values(effect || {}).some(pair => pair.before !== pair.after) && !effects.references.get(tx.id)?.length &&
+				!coincidentWitness)) return historyFailure('history_unavailable');
 			const row = {record, splices, metadata: effect};
 			rows.push(row); byId.set(tx.id, row); prior = tx.revision;
 		}
@@ -116,7 +123,9 @@ function prepareHistory(input) {
 			row.beforeSource = initial; row.beforeMetadata = initialMetadata;
 		}
 		const earliestRevision = records[0]?.transaction.baseRevision ?? revision;
-		let root = earliestRevision === 0 ? textRootParts(initial.parts()) : null, rootRevision = earliestRevision;
+		// The window's owner may name its root (the source store mints it once per text); otherwise hash the initial text.
+		let root = earliestRevision === 0 ? (typeof input.earliestRoot === 'string' && input.earliestRoot || textRootParts(initial.parts())) : null,
+			rootRevision = earliestRevision;
 		for (const {record, splices} of rows) {
 			const hashed = Object.hasOwn(record, 'beforeHash') || Object.hasOwn(record, 'afterHash');
 			if (hashed && (![record.beforeHash, record.afterHash].every(value =>
@@ -281,10 +290,19 @@ export function historyPlaces(input, blocks) {
 			}
 			touched.set(node, after);
 		});
+		// Blocks one splice covers share its range (a whole-document delete maps every block to all it removed): slice each range once.
+		const slices = new Map(), cut = (source, side, from, to) => {
+			const key = side + from + ':' + to;
+			if (!slices.has(key)) slices.set(key, source.slice(from, to));
+			return slices.get(key);
+		};
+		// One record's act is read once; the blocks it touched share its fields (a whole-document delete touches every block).
+		let act = null;
 		for (const [node, afterRange] of touched) {
-			const beforeRange = ranges.range(node), previous = {...beforeRange, source: beforeSource.slice(beforeRange.from, beforeRange.to)},
-				after = {...afterRange, source: afterSource.slice(afterRange.from, afterRange.to)};
-			if (previous.source !== after.source) node.block.acts.push({...historyAct(record), before: previous, after});
+			const beforeRange = ranges.range(node), previous = {...beforeRange, source: cut(beforeSource, 'b', beforeRange.from, beforeRange.to)},
+				after = {...afterRange, source: cut(afterSource, 'a', afterRange.from, afterRange.to)};
+			// A point (where words were deleted) has no words to compare: the act that touched it wrote there.
+			if (previous.source !== after.source || afterRange.from === afterRange.to) node.block.acts.push({...(act ||= historyAct(record)), before: previous, after});
 		}
 	}
 
@@ -322,7 +340,27 @@ export function selectiveUndo(input, actIds, options = {}) {
 	const metadata = _rapierMetadataDelta(prepared.metadata, afterMetadata), effectChanged = selected.size > 0;
 	const sourceEffectChanged = records.some(record => record.splices.length && !prepared.effects.references.get(record.transaction.id)?.length &&
 		prepared.effects.active.has(record.transaction.id) !== projectedEffects.active.has(record.transaction.id));
-	if (!sourceEffectChanged) return {ok: true, splices: [], after: prepared.source, actIds: [...requested],
+	// One shared replacement is visible while any of its authors is active. That
+	// includes an author stored with no second physical splice, and an inverse
+	// whose only effect is to make such an author active again.
+	let coverVisibilityChanged = false;
+	if (!sourceEffectChanged && selected.size) {
+		let origins = null;
+		try { origins = authoredPlacements(prepared.initialSource, records); } catch { origins = null; }
+		const groups = new Map();
+		if (origins) for (const record of records) {
+			const tx = record.transaction, origin = origins.get(tx.id);
+			if (!origin?.splices.some(row => row.removed.length) || tx.reverts || tx.reapplies ||
+				tx.sourceTransactionId || tx.sourceTransactionIds?.length) continue;
+			const key = canonicalJSON({basis: origin.basis, splices: origin.splices});
+			if (!groups.has(key)) groups.set(key, []);
+			groups.get(key).push(tx.id);
+		}
+		const covered = (effects, ids) => ids.some(id => effects.active.has(id));
+		for (const ids of groups.values()) if (ids.length > 1 && covered(prepared.effects, ids) !== covered(projectedEffects, ids))
+			coverVisibilityChanged = true;
+	}
+	if (!sourceEffectChanged && !coverVisibilityChanged) return {ok: true, splices: [], after: prepared.source, actIds: [...requested],
 		sourceTransactionIds: [...selected], metadata, afterMetadata, effectChanged, unchanged: !metadata && !effectChanged,
 		superseded: [], overlaps: []};
 	try {